Did this page help you? Yes No Tell us about it...

Securing Your Content in Amazon S3

Topics

To secure your content in Amazon S3, you create a CloudFront origin access identity and set the ACL on the objects or buckets in Amazon S3 to be accessible only by that identity. This section describes what an origin access identity is, shows you how to modify your distribution to include a CloudFront origin access identity, and how to authorize CloudFront access to data in Amazon S3.

Overview of the CloudFront Origin Access Identity

A CloudFront origin access identity is a virtual identity that allows CloudFront to fetch content from an Amazon S3 bucket. To use an origin access identity to secure your content in Amazon S3, you perform the following tasks:

Create a CloudFront origin access identity for your AWS account. For more information, see Creating a CloudFront Origin Access Identity.
Add the origin access identity to your distribution. For download distributions, you can choose whether to add an origin access identity for each Amazon S3 origin. For streaming distributions, an origin access identity applies to the entire distribution. For more information, see Creating a Private Content Distribution.
Give the origin access identity read permission (or read and download permission) to objects in Amazon S3, and modify the bucket policy or any object ACLs as appropriate to ensure that the objects are not publicly available. For more information, see Updating Amazon S3 Bucket Policies or ACLs on Your Private Content Buckets or Objects.

After you remove public access to the Amazon S3 bucket, the CloudFront distribution is now the only way to access objects in your bucket. Adding signer accounts to the distribution configuration allows access only to users who have signed URLs.

You can have up to 100 CloudFront origin access identities, and you can attach each to one or more distributions. One origin access identity is usually sufficient, even for multiple distributions.

The following example depicts three different distributions.

Serving public and private content from same origin

	Distribution 1 is configured for public content. The object has an Amazon S3 ACL that grants everyone `read` permission. Anyone can access the contents of this distribution through Amazon S3 or through your CloudFront distribution.
	Distribution 2 is configured to read private content with signed URLs. This distribution is attached to CloudFront origin access identity A. The object has an Amazon S3 ACL that grants `read` permission to the identity. The content in this distribution cannot be accessed by anyone who doesn't have the signed URL.
	Distribution 3 is configured to read private content with public URLs. This distribution is also attached to CloudFront origin access identity A. The object has an Amazon S3 ACL that grants `read` permission to the identity. The content in this distribution is not private, but users can access it only through your CloudFront distribution (not through your Amazon S3 bucket).

Creating a CloudFront Origin Access Identity

You can create a CloudFront origin access identity using a POST on the 2012-05-05/origin-access-identity/cloudfront resource. You must provide a unique caller reference in the request, as you do when creating a distribution. You can optionally provide comments about the identity.

	Note
	Currently, the AWS Management Console doesn't support creating an origin access identity or updating a distribution to serve private content.

To create a CloudFront origin access identity for your distribution

Send a CloudFront control API request that is similar to the following example.

POST /2012-05-05/origin-access-identity/cloudfront HTTP/1.1
[Required headers]  

<?xml version="1.0" encoding="UTF-8"?>
<CloudFrontOriginAccessIdentityConfig xmlns="http://cloudfront.amazonaws.com/doc/2012-05-05/">
  <CallerReference>20120229090000</CallerReference>   
  <Comment>Your comments here</Comment>
</CloudFrontOriginAccessIdentityConfig>

You will receive a response that looks similar to the following example.

201 Created
Location: https://cloudfront.amazonaws.com/2012-05-05/origin-access-identity/cloudfront/E74FTE3AEXAMPLE
x-amz-request-id: request_id

<?xml version="1.0" encoding="UTF-8"?>
<CloudFrontOriginAccessIdentity xmlns="http://cloudfront.amazonaws.com/doc/2012-05-05/">
  <Id>E74FTE3AEXAMPLE</Id>
  <S3CanonicalUserId>
     cd13868f797c227fbea2830611a26fe0a21ba1b826ab4bed9b7771c9aEXAMPLE
  </S3CanonicalUserId>
  <CloudFrontOriginAccessIdentityConfig>
    <CallerReference>20120229090000</CallerReference>   
    <Comment>Your comments here</Comment>
  </CloudFrontOriginAccessIdentityConfig>
</CloudFrontOriginAccessIdentity>

Record the Id and the S3CanonicalUserId for the new CloudFront origin access identity.
You will use these values later in the process. You use the Id to associate an origin access ID with your distribution, and the S3CanonicalUserId identifies CloudFront in the Amazon S3 ACL on the object. For more information about origin access ID or the Canonical User ID, go to Actions on Origin Access Identities in the Amazon CloudFront API Reference.

	Note
	The CloudFront API includes actions for creating and managing your CloudFront origin access identities. For more information, go to Actions on Origin Access Identities in the Amazon CloudFront API Reference.

Now that you have an origin access identity, you can create a distribution configured for private content. For more information, see Creating a Private Content Distribution.

Creating a Private Content Distribution

A distribution can serve either public or private content as specified by configuration values. To configure a distribution to serve private content, you use your AWS account, or a trusted AWS account you specify, to get a key pair. (If you already have an RSA key pair, you can upload the public key to AWS.) You then use the private key from the key pair to hash a policy statement; the result is a signature that you use to authenticate that the policy was generated by a trusted signer and has not been tampered with.

A private content distribution looks like a public content distribution, except that it has an OriginAccessIdentity element in the configuration. You must specify the value for the element using the following format: origin-access-identity/cloudfront/ID.

To create a private content distribution, use the CloudFront API to create a new distribution or update an existing distribution and include an OriginAccessIdentity element. See the applicable topic in the Amazon CloudFront API Reference:

Create a new download distribution: POST Distribution
Update an existing download distribution: PUT Distribution Config
Create a new streaming distribution: POST Streaming Distribution
Update an existing streaming distribution: PUT Streaming Distribution Config

Now that you have created a distribution configured for private content, you need to set the ACLs on your Amazon S3 private content objects. For more information, see Updating Amazon S3 Bucket Policies or ACLs on Your Private Content Buckets or Objects.

Updating Amazon S3 Bucket Policies or ACLs on Your Private Content Buckets or Objects

After you create a private content distribution, you must update Amazon S3 bucket policies or ACLs to grant the CloudFront origin access identity the permissions necessary to access to the private content in Amazon S3. Note the following:

You may find it easier to update Amazon S3 bucket policies than ACLs because you can add objects to the bucket without updating permissions. However, ACLs give you more fine-grained control because you're granting permissions on each object.
If you updated a public-content distribution to serve private content, modify the bucket policy or any object ACLs as appropriate to ensure that the objects are not publicly available.
Both for bucket policies and for ACLs, when you specify the CloudFront entity to which you are granting access, use the S3CanonicalUserId element that was returned when you created a CloudFront origin access identity.

Updating Amazon S3 Bucket Policies

Using either the AWS Management Console or the Amazon S3 API, change the Amazon S3 bucket policy to allow the CloudFront origin access identity to access objects in the bucket. For more information, go to Using Bucket Policies in the Amazon Simple Storage Service Developer Guide. For an example, see "Granting Permission, Using Canonical ID, to a CloudFront Origin Identify" in the topic Example Cases for Amazon S3 Bucket Policies, also in the Amazon Simple Storage Service Developer Guide.

Updating Amazon S3 ACLs

Using either the AWS Management Console or the Amazon S3 API, change the Amazon S3 ACL to give CloudFront READ permission on each object that the CloudFront distribution serves. For more information, go to Using ACLs in the Amazon Simple Storage Service Developer Guide.

You can also change the ACLs using code and one of the AWS SDKs. For an example, see the downloadable sample code in Create a URL Signature Using C# and the .NET Framework.

What's Next?

After you grant the CloudFront origin access identity the permissions necessary to access your Amazon S3 content, you may want to restrict end-user access to your distribution and create a signed URL. For more information, go to Restricting End User Access.

Document Conventions
Terms of Use

Did this page help you? Yes No Tell us about it...